Google Extends Gmail Client-Side Encryption to All Users
For the 21st anniversary of the electronic mail service, Google has given Gmail an easy-to-use end-to-end encryption option.
The fresh feature is designed to minimize the complexities of installing and using a full encryption service to protect sensitive email, such as S/MIME and various proprietary solutions
On April 1, this feature launched in beta, with the ability to send end-to-end encrypted (E2EE) emails to any other Gmail users within your own organization.
In the coming weeks, users will be able to send E2EE emails to any Gmail inbox.
By the end of the year, Gmail users will be able to send fully encrypted messages to any email inbox, regardless of the platform or provider.
“The idea here is simple. Email messages are encrypted with just a few clicks in Gmail regardless of who they are being sent to — no need for end users to exchange certificates or use custom software,” wrote Google Workspace Product Managers Johney Burke and Julien Duplant in a blog item issued on Tuesday.
“And the IT team no longer needs to go through the complex S/MIME setup or certificate management.”
Client-Side Encryption
The service builds on the existing Google Workplace‘s Client-Side Encryption, a Google service for encrypting email within the Gmail universe.
Previously, only users of Workplace’s Enterprise Plus, Education Standard and Education Plus could deploy this feature.
With CSE, clients use encryption keys that are generated and stored in a cloud-based key management service, so the organization controls the keys and who has access to them. Recipients do not require a key to view the message.
The contents of the e-mail can then be encrypted though the email header — with subject, timestamps, and recipients — remains in plain text. The sender of the email can, through a new set of classification labels, set controls on the email, such as how long it can remain accessible.
For those without Gmail altogether they will be able to access the encrypted mail in “a restricted version of Gmail, using a guest Google Workspace account,” the Google docs note.
Less Work For Admins, Too
The blog announcement asserted that users will no longer have to worry about managing digital certificates — and CSE can be set as default for all mail being sent.
There is still some work for the admin in terms of managing the keys.
Today, for organizations that want end-to-end encrypted emails, including at rest and in transit, have to implement S/MIME, which requires managing digital certificates, and making sure each user has S/MIME configured properly as to participate in the exchange of certs.
“Few do,” the blog posters comment.
CSE’s cloud-based management simplifies this routine, with all the keys stored and managed in a central location. Google has no access to these keys.
An admin can revoke a user’s access to keys, as well as monitor the files that are encrypted.
